Ernst & Young (EY), a global accounting and consulting firm, inadvertently exposed a 4-terabyte (TB) SQL Server database backup on the public internet. The unsecured .BAK file, discovered by a Neo Security researcher, contained highly sensitive internal data, including database schemas, stored procedures, API keys, session tokens, user credentials, and service account passwords—effectively a 'master blueprint' to EY’s digital infrastructure. While EY confirmed the exposure and claimed no client, personal, or confidential data was compromised, the incident stemmed from an acquired entity under EY Italy, disconnected from its global systems. The file remained accessible for an estimated week before remediation, raising concerns about potential access by malicious actors. EY’s response was praised for professionalism, though the delayed fix highlighted operational vulnerabilities. The exposure risked unauthorized access to critical systems, credential theft, and potential lateral movement within EY’s network, though the firm asserted no evidence of exploitation.

NCB Management Services Inc. faced a 2023 data breach that exposed the personal information of over 1.6 million Bank of America customers. The incident led to a $2.625 million settlement after a lawsuit alleged negligence in safeguarding sensitive data. Affected individuals—part of the settlement class—became eligible for reimbursement of up to $2,500 for documented financial losses tied to the breach or an alternative cash payout from the settlement fund. The breach’s fallout included potential identity theft risks, financial fraud, and reputational harm for both NCB and Bank of America. A U.S. District Court judge approved the settlement, underscoring the breach’s severe consequences for customer trust and regulatory compliance. The exposed data likely included personally identifiable information (PII), heightening vulnerabilities for the victims.

The California Office of the Attorney General reported that NCB Management Services, Inc. experienced a data breach discovered on February 4, 2023. An unauthorized party accessed personal information on February 1, 2023. The breach notification was made on May 22, 2023, but the specific number of individuals affected and the exact types of compromised data are unknown.